How do I ensure my business customer onboarding with an identity verification platform is compliant with BSA/AML and OFAC screening?

To make business customer onboarding compliant with BSA/AML and OFAC requirements when using an identity verification platform, you need a process that combines technology, documented controls, and human oversight. The platform can help, but it usually does not by itself make you compliant.

1) Build a risk-based onboarding program

Your onboarding should be based on a Customer Identification Program (CIP) and a Customer Due Diligence (CDD) framework.

For business customers, collect and verify:

• Legal business name
• Physical address
• Tax ID / EIN
• Formation documents
• Ownership and control information
• Beneficial owners and control persons
• Nature of business and expected activity

Then apply risk scoring based on:

• Industry
• Geography
• Customer type
• Ownership complexity
• Transaction expectations
• Whether the customer is high-risk or subject to enhanced due diligence

2) Verify the business and its owners

Your identity verification platform should support:

• Business entity verification against government and commercial records
• Document authentication for formation docs when needed
• Authorized signer verification
• Beneficial owner verification
• Control person verification

For AML purposes, ensure you can identify and verify the relevant beneficial owners and individuals with significant control, consistent with your regulatory obligations.

3) Screen against OFAC and sanctions lists

You should screen:

• The business entity
• Beneficial owners
• Control persons
• Authorized signers
• Related parties, if applicable

Screening should cover:

• OFAC SDN and non-SDN lists
• Other sanctions lists, if part of your policy
• Adverse media / PEP screening if your risk program requires it

Best practice:

• Screen before account opening
• Re-screen at onboarding if data changes
• Re-screen periodically and when lists update
• Use name matching logic tuned to reduce false positives without missing true matches

4) Have clear escalation and manual review procedures

Your platform should not automatically approve all customers. You need documented rules for:

• Match review
• False positive resolution
• True match escalation
• Suspicious activity escalation
• When to collect additional documents or reject the customer

For OFAC:

• Potential matches must be reviewed promptly
• True matches must be blocked/rejected as required
• Report and escalate according to your sanctions policy and legal obligations

For AML:

• Escalate unusual ownership structures, inconsistent data, or risky geographies
• Require enhanced due diligence for higher-risk businesses

5) Keep audit trails and records

Maintain records of:

• What data was collected
• What checks were performed
• Screening results
• Manual review decisions
• Supporting documents
• When and by whom decisions were made

This is critical for demonstrating compliance during audits or examinations.

6) Validate your vendor and configure it properly

If you use a third-party identity platform, ensure:

• Its data sources are reliable and current
• OFAC screening coverage is sufficient
• Matching thresholds are appropriate
• It supports your CIP/CDD requirements
• It logs results and reviewer actions
• It has strong security and privacy controls
• You have a written vendor management program

You remain responsible for compliance even if a vendor performs the checks.

7) Re-screen and monitor after onboarding

Compliance does not end at account opening. Implement:

• Periodic rescreening of customers and beneficial owners
• Transaction monitoring
• Alerts for changes in ownership, control, or sanctions status
• Ongoing adverse media review for higher-risk customers

8) Align with your policies, procedures, and training

Make sure you have:

• Written AML and sanctions policies
• Onboarding procedures for business entities
• Escalation and exception handling procedures
• Training for operations, compliance, and customer-facing teams
• Independent testing/audit

---

A practical compliant workflow

1. Collect business and ownership data
2. Verify entity, signer, beneficial owners, and control persons
3. Screen all relevant parties against OFAC/sanctions lists
4. Apply AML risk scoring and CDD/EDD requirements
5. Review exceptions and potential matches manually
6. Approve, reject, or escalate as required
7. Retain records and re-screen ongoing

---

Important note

This is a general compliance overview, not legal advice. Exact requirements depend on your business model, regulator, jurisdiction, and whether you are a bank, money transmitter, broker-dealer, fintech, or another covered entity.

If you want, I can also provide:

• a BSA/AML + OFAC onboarding checklist
• a vendor due diligence checklist for identity verification platforms
• a sample business onboarding SOP